Eavesdropping on the "Ping-Pong" Quantum Communication Protocol Freely in a 
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We introduce an attack scheme for eavesdropping tlie ping-pong quantum communication protocol 
proposed by Bostrom and Felbinger [Pliys. Rev. Lett. 89, 187902 (2002)] freely in a noise channel. 
The vicious eavesdropper, Eve, intercepts and measures the travel photon transmitted between the 
sender and the receiver. Then she replaces the quantum signal with a multi-photon signal in a 
same state, and measures the photons return with the measuring basis with which Eve prepares 
the fake signal except for one photon. This attack increase neither the quantum channel losses nor 
the error rate in the sampling instances for eavesdropping check. It works for eavesdropping the 
secret message transmitted with the ping-pong protocol. Finally, we propose a way for improving 
the security of the ping-pong protocol. 

PACS numbers: 03.67.Hk, 03.65. Ta, 89.70.+C 
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Quantum mechanics offers some unique capabilities for 
the processing of information, such as quantum compu- 
tation and quantum communication Quantum cryp- 
tography, one of the most mature quantum techniques, 
provides a novel way for transmitting of message se- 
curely. Since Bennett and Brassard proposed the orig- 
inal quantum key distribution (QKD) protocol in 1984, 
a lot of works have been focused on this topic, such as 
0, S S S 1 0, i, S, Eol, [O, m • In QKD, the two parties, 
say the sender, Alice and the receiver. Bob, can create 
a random binary string with quantum channel uncondi- 
tionally secure [l|. The no-cloning theorem [13] forbids 
any eavesdropper to eavesdropping an unknown quantum 
state without disturbing it. In fact, QKD is secure as the 
authorized users can find out the eavesdropping done by 
Eve if she wants to steal the quantum information, and 
then they discard the string, which does not reveal the 
secret message. 

Recently, a novel concept, quantum secure direct com- 
munication (QSDC), was pro posed and actively pursued 
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Also, it is extended for controlled teleportation 
With QSDC, the secret message is transmitted directly 
without first creating a random key to encrypt it, which 
is different from QKD whose object is just to establish 
a common random key between two remote parties. As 
the secret message cannot be altered by the two autho- 
rized users when it has been transmitted in the quan- 
tum channel, the security of QSDC depends on the fact 
that Eve can only get a random outcome if she mon- 
itors the line [U [3, [l3|- Moreover, Alice and Bob 



can detect the eavesdropping if Eve monitors the quan- 
tum line before they code the message on the quantum 
states. By far, almost all the existing QSDC protocols 
can be attributed to one of the two types. The first one 
are the QSDC protocols in which the secret message can 
be read out directly without exchanging an additional 
classical information for each qubit except for the sam- 
pling qubits for eavesd roppin g check, such as those in 
Refs.di, m, [H, 113, m, El, lo|. The other one are those 
protocols in which each qubit can be read out by the le- 
gitimate user after at least a bit of classical information 
is exchanged [2TI. [2^. [23l [2^ [25| . An interesting feature of 
the QSDC protocols in Refs. jl5l.[l6l.[T7j is that the quan- 
tum states are transmitted in a quantum data block and 
the two legitimate users can maintain its security with 
error correction and quantum privacy in a noise channel. 

The famous ping-pong QSDC protocol [ij] proposed 
by Bostrom and Felbinger has been claimed to be secure 
for establishing a random key and quasisecure for trans- 
mitting a plain text message (a secret message) as Eve is 
able to gain a small amount of message information be- 
fore being detected ■ Recently, the ping-pong protocol 
is proven insecure if the quantum channel losses are high 
enough |l,[l,[3l even for distributing a common ran- 
dom key. Also it can be attacked without eavesdropping 
[13, In this paper, we will show that the ping-pong 
protocol can be eavesdropped freely if the error rate in- 
troduced by the quantum channel noise is not zero, not 
requiring that the loss of the quantum channel is high. 
Moreover, we introduce a way for improving its security 
in a noise channel. 
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In the ping-pong QSDC protocol [T3], the message re- 
ceiver Bob prepares the quantum source, an Einstein- 
Podolsky-Rosen (EPR) pair. An EPR pair is in one of 
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FIG. 1: Schematic demonstration of the ping-pong QSDC 
protocol, similar to the figure 1 in the Ref. [13] • Alice is the 
sender of message, and Bob is the receiver. 
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the four Bell states shown as following 



FIG. 2: The state of the multi-photon fake signal. | -1- 9) and 
I — 9) are the two eigenstates of the measuring basis as- 



|^±) = ^(|0)|1)±|1)|0)), 
|0±) = i=(|O)|O)±|l)|l)), 



(1) 



where |0) and |1) are the horizontal and vertical polarized 
states of a single photon, respectively. The two photons 
in each EPR pair prepared by Bob are in the maximal 
entangled state 1^-+) = ^(|0)/f|l)T + |1)h|0)t). Here 7J 
and T represent the home qubit and the travel qubit [3] , 
respectively. Similar to quantum dense coding [s^, Bob 
keeps the qubit H and sends the qubit T to Alice. Alice 
chooses two modes, the control mode and the message 
mode, for dealing with the T qubit, i.e., a probability c 
for picking up the control mode for the photon and 1 — c 
for coding the message. When she chooses the control 
mode, Alice performs a single-photon measurement on 
the T qubit with the horizontal-vertical measuring basis 
(MB), say az, otherwise she codes the photon with / — 
|0)(0| + and Z = |0)(0| - |1)(1| when the messages 

are and 1, respectively. 



{Z(^I)\iP+) = IV"). 



(2) 



Cai introduced an attack way without eavesdropping 
[l^. In Cai eavesdropping scheme. Eve measures the T 
photon with the MB a^. This attack cannot be detected 
if Alice and Bob only take the MB cr^ on their sampling 
photons. In an ideal channel without noise and loss, this 
attack cannot get the information about the secret mes- 
sage. However, we have to confess that there are noises in 
a practical quantum channel which will introduce an er- 
ror rate Sc in the outcomes [11, [2| ■ With the improvement 
of technology, Ec can be small, but not zero. Moreover, 
a single-photon detector has a special recovery time (i.e., 
the dead time) 2] in which the N photons attained are 
recorded as just one. Eve can exploit the error rate Sc 
and the recovery time to hide her eavesdropping on the 
ping-pong protocol and get almost all the information 
about the secret message with a multi-photon fake signal 
even though the quantum channel loss is low. We intro- 
duce it in detail as following, similar to the Trojan horse 
attack in Ref. [2, |36(| . 
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FIG. 3: The attack with the photon number splitters (PNS: 
50/50) in the case that there are four photons in each fake 
signal. 



For the eavesdropping. Eve first intercepts and mea- 
sures the T photon with MB az, and then she prepares 
an A^-photon fake signal with the MB ae whose two eigen- 
states can be written as 



cosd\0) + sind\l), 
-sin0\O) +£056*11), 



where 6* e [0, f ) and 



< Sc 



(3) 
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When the outcome of the measurement is |0)t. Eve 
prepares the A^-photon fake signal in the same state 
\ + 0) — 0056*10) -I- sin9\l), shown in Fig. 2, and resends it 
to Alice in a time slot, shorter than the recovery time of 
the single-photon detector. As its dead time, Ahce's de- 
tector only records a single photon when Alice measures 
the signal by choosing the control mode with the MB cr^ . 
In this way. Eve's eavesdropping will introduce the error 
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rate Ee = sin^O in the sampling instances between Alice 
and Bob. Eve can use a better quantum channel with 
which the error rate is lower by far than the origin one 
to hide her eavesdropping freely. 

As an example for demonstrating the principle of this 
attack, we assume that Sc — 10% and Eve uses an ideal 
quantum channel to steal the message below. As the 
symmetric, we assume that there are N = 2™ photons in 
the fake signal. 

EE = siii^e ^ Ec = O-l- (5) 

After the coding done by Bob with one of the two local 
unitary operations / and Eve intercepts the fake signal 
again. She splits the multi-photon signal with some pho- 
ton number splitters (PNS: 50/50), and sends one photon 
to Bob and measures the other photons, see in Fig. 3. 

If Alice performs the I operation on the fake signal, 
the photons in the fake signal are in the state |T') = | + 
0) = cos0\O) + sine\l); otherwise \T') = \e') = cose\Q) - 
sin6\l). The attack for obtaining the information about 
the local unitary operations done by Alice is simplified to 
distinguish those two states. It is impossible for Eve to 
get almost all the information about Alice's operation if 
she has only one photon coded by Ahce as \{9'\ + 0)\'^ — 
cos^29 — 0.64. But the story is changed if there are 
many photons in each fake signal. Eve can distinguish 
those two states with a large probability and then steal 
almost all of the message freely. 

Fig. 3 gives us an example for Eve to eavesdrop the 
message with four photons in each fake signal. Eve splits 
the fake signal with three PNS when the signal returns 
from Alice to Bob. She sends one of the four photons 
to Bob and measures the other three photons with the 
MB (70, see Fig. 2. If the three photons are all in state 
\ + 9) — cos9\0) + sin9\l), i.e., Alice performs the iden- 
tity operation / on the fake signal. Eve gets the out- 
come I -I- 9) with the probability 100%; otherwise Eve 
has the probability {cos^29)''~^ = (0.64)3 ^ 0.262144 
to obtain the state | -I- 9) for her measurements on all 
the three photons. That is. Eve has the probability 
Pe = 0.262144 that she will fail to distinguish the two 
operations done by Alice on the fake signal. If there are 
N photons with which Eve distinguish the two states 
I -I- 9) and 16*'), the probability that Eve will fail is re- 
duced to Pe = (cos226')"^i = (0.64)"-i. When n=64, 
Pe = 6.16 X 10"^'^. It means that Eve can obtain the 
message fully if there are a large number of photons in 
each fake signal as this attack increases neither the signal 
losses nor the error rate in the sampling instances. 

In essence, the security issue in ping-pong QSDC pro- 
tocol jlij arose from the fact that the two authorized 
users transmit the qubits one by one and check the eaves- 
dropping only with the same MB az- The secret mes- 
sage transmitted cannot be discarded, different from the 
outcomes in QKD [2^. For improving its security, it is 



necessary for Alice and Bob to transmit the qubits in a 
quantum data block, similar to [Tsl . [161 [iTj . and mea- 
sure the sampling instances with two MBs CTz and (Tx- 
Here a, = {^(|0) + |1)), ^(|0) - |1))}. As the eaves- 
dropping check depends on the public statistical analysis 
of the sampling instances, the transmission of the quan- 
tum data block ensures that the message is coded after 
the verification process is accomplished. Moreover, the 
two parties can do quantum privacy amplification on the 
quantum date [l^, [T^, [l3l before Alice codes her message 
on the quantum states. Those two interesting characters 
paly an important role in the security of QSDC protocols. 

With the two MBs for the sampling instances, the ac- 
tion done by the eavesdropper. Eve will leave a trace in 
the results and will be detected. Moreover, this modifi- 
cation can improve the capacity in the ping-pong QSDC 
protocol, as discussed in Ref. [sj- For most of the ex- 
isting QSDC protocols, there is a probability that Eve 
can get a part of message if she eavesdrops the quantum 
channel with a Trojan horse attack strategy and re- 
placing the original quantum channel with an ideal one. 
In the QSDC protocols [l^, [H, [13], the parties can re- 
duce the information leaked to Eve to a negligible value 
with quantum privacy amplification 0, [isl [l6|. Also, 
Alice and Bob can prevent Eve from eavesdropping with 
this attack if they use some PNS to monitor the sampling 
instances. That is, they split the signal with some PNS 
and measure them individually with choosing the MB az 
and ax randomly, similar to Ref. [361]. This strategy for 
eavesdropping check can also be used to improve the se- 
curity in the QKD protocol [5| and the secure determinis- 
tic communication protocol [38| proposed by Lucamarini 
and Mancini following the ideas in Refs. 0, [l^. In a 
practical application, the users can also use some photon 
beam splitters to replace the PNSs. 

In conclusion we have presented an attack strategy on 
the ping-pong QSDC protocol freely in a noise quantum 
channel. This attack works for getting the secret mes- 
sage transmitted with the ping-pong protocol 14]. The 
eavesdropper. Eve can intercept the signal transmitted 
between Alice and Bob and measures it first, and then 
she replaces it with a multi-photon fake signal. Eve's 
eavesdropping can be hidden by the error rate introduced 
by the noise in the practical quantum channel and the 
dead time of a detector. She can obtain almost all the 
information about the message with some photon num- 
ber splitters and measurements along some a direction. 
We also suggest the way for improving the security of 
the ping-pong protocol and introduce a way for prevent 
the eavesdropper from stealing the information with the 
Trojan horse attack strategy. 
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